CVE-2024-49902 in Linux
Summary
by MITRE • 10/21/2024
In the Linux kernel, the following vulnerability has been resolved:
jfs: check if leafidx greater than num leaves per dmap tree
syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.
Shaggy: Modified sanity check to apply to control pages as well as leaf pages.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/19/2026
The vulnerability identified as CVE-2024-49902 affects the Linux kernel's JFS (Journaled File System) implementation, specifically within the dmap tree data structure management. This issue arises from insufficient bounds checking during the allocation and traversal of dmap tree nodes, creating a potential avenue for out-of-bounds memory access that could be exploited to compromise system integrity. The vulnerability was discovered through automated fuzzing analysis by syzbot, which identified a critical memory access violation in the dbSplit function, indicating that the system was attempting to access memory locations beyond the allocated bounds of the dmap tree structure.
The technical flaw manifests when the dmt_leafidx parameter exceeds the maximum number of leaves permitted within a dmap tree, causing a buffer overflow condition in the dbFindLeaf function. This occurs because the system fails to validate that the leaf index value remains within acceptable parameters before proceeding with tree traversal operations. The root cause stems from inadequate input validation within the JFS subsystem, where the dmap tree management code does not properly enforce bounds checking on leaf indices, particularly when dealing with control pages that manage the tree structure. This vulnerability represents a classic case of insufficient bounds checking, which falls under CWE-129, and demonstrates the critical importance of validating array indices and pointer arithmetic in kernel space operations.
The operational impact of this vulnerability extends beyond simple memory corruption, as it could potentially enable privilege escalation or denial of service conditions within systems utilizing JFS. When exploited, the out-of-bounds access could allow malicious actors to manipulate kernel memory structures, potentially leading to system crashes or unauthorized code execution. The vulnerability affects systems running Linux kernels with JFS filesystem support, particularly those handling large or complex directory structures where dmap trees are actively managed. Attackers could leverage this weakness to cause system instability or potentially gain elevated privileges, making it a significant concern for enterprise environments relying on JFS for data storage management.
Mitigation strategies for CVE-2024-49902 should prioritize applying the official kernel patches that implement proper bounds checking for dmt_leafidx values in both leaf pages and control pages. System administrators should immediately update their Linux kernel versions to include the patched implementation that modifies the sanity check to cover all page types within the dmap tree structure. Additionally, monitoring systems should be enhanced to detect anomalous dmap tree operations that might indicate attempted exploitation of this vulnerability. The fix aligns with ATT&CK technique T1068 by addressing privilege escalation vectors through kernel space memory corruption, and follows security best practices outlined in the Linux kernel security documentation for preventing buffer overflows in filesystem implementations. Organizations should also consider implementing runtime protections such as kernel address space layout randomization and stack canaries to further reduce the exploitability of similar vulnerabilities in the JFS subsystem.